Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: docker/cli
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 5927d80
Choose a base ref
...
head repository: docker/cli
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: c2be9cc
Choose a head ref
  • 9 commits
  • 14 files changed
  • 4 contributors

Commits on Mar 25, 2026

  1. update to go1.25.8 

    go1.25.8 (released 2026-03-05) includes security fixes to the html/template,
net/url, and os packages, as well as bug fixes to the go command, the compiler,
and the os package. See the Go 1.25.8 milestone on our issue tracker for details.

- 1.25.8 https://github.com/golang/go/issues?q=milestone%3AGo1.25.8+label%3ACherryPickApproved
- diff: golang/go@go1.25.7...go1.25.8
- 1.26.1 https://github.com/golang/go/issues?q=milestone%3AGo1.26.1+label%3ACherryPickApproved
- diff: golang/go@go1.26.0...go1.26.1

---

We have just released Go versions 1.26.1 and 1.25.8, minor point releases.

These releases include 5 security fixes following the security policy:

crypto/x509: incorrect enforcement of email constraints

- When verifying a certificate chain which contains a certificate containing
  multiple email address constraints (composed of the full email address) which
  share common local portions (the portion of the address before the '@'
  character) but different domain portions (the portion of the address after the
  '@' character), these constraints will not be properly applied, and only the
  last constraint will be considered.

  This can allow certificates in the chain containing email addresses which are
  either not permitted or excluded by the relevant constraints to be returned by
  calls to Certificate.Verify. Since the name constraint checks happen after chain
  building is complete, this only applies to certificate chains which chain to
  trusted roots (root certificates either in VerifyOptions.Roots or in the system
  root certificate pool), requiring a trusted CA to issue certificates containing
  either not permitted or excluded email addresses.

  This issue only affects Go 1.26.

  Thanks to Jakub Ciolek for reporting this issue.

  This is CVE-2026-27137 and Go issue https://go.dev/issue/77952.

- crypto/x509: panic in name constraint checking for malformed certificates

  Certificate verification can panic when a certificate in the chain has an empty
  DNS name and another certificate in the chain has excluded name constraints.
  This can crash programs that are either directly verifying X.509 certificate
  chains, or those that use TLS.

  Since the name constraint checks happen after chain building is complete, this
  only applies to certificate chains which chain to trusted roots (root
  certificates either in VerifyOptions.Roots or in the system root certificate
  pool), requiring a trusted CA to issue certificates containing malformed DNS
  names.

  This issue only affects Go 1.26.

  Thanks to Jakub Ciolek for reporting this issue.

  This is CVE-2026-27138 and Go issue https://go.dev/issue/77953.

- html/template: URLs in meta content attribute actions are not escaped

  Actions which insert URLs into the content attribute of HTML meta tags are not
  escaped. This can allow XSS if the meta tag also has an http-equiv attribute
  with the value "refresh".

  A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be
  used to disable escaping URLs in actions in the meta content attribute which
  follow "url=" by setting htmlmetacontenturlescape=0.

  This is CVE-2026-27142 and Go issue https://go.dev/issue/77954.

- net/url: reject IPv6 literal not at start of host

  The Go standard library function net/url.Parse insufficiently
  validated the host/authority component and accepted some invalid URLs
  by effectively treating garbage before an IP-literal as ignorable.
  The function should have rejected this as invalid.

  To prevent this behavior, net/url.Parse now rejects IPv6 literals
  that do not appear at the start of the host subcomponent of a URL.

  Thanks to Masaki Hara (https://github.com/qnighy) of Wantedly.

  This is CVE-2026-25679 and Go issue https://go.dev/issue/77578.

- os: FileInfo can escape from a Root

  On Unix platforms, when listing the contents of a directory using
  File.ReadDir or File.Readdir the returned FileInfo could reference
  a file outside of the Root in which the File was opened.

  The contents of the FileInfo were populated using the lstat system
  call, which takes the path to the file as a parameter. If a component
  of the full path of the file described by the FileInfo is replaced with
  a symbolic link, the target of the lstat can be directed to another
  location on the filesystem.

  The impact of this escape is limited to reading metadata provided by
  lstat from arbitrary locations on the filesystem. This could be used
  to probe for the presence or absence of files as well as gleaning
  metadata like file sizes, but does not permit reading or writing files
  outside the root.

  The FileInfo is now populated using fstatat.

  Thank you to Miloslav Trmač of Red Hat for reporting this issue.

  This is CVE-2026-27139 and Go issue https://go.dev/issue/77827.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f7d83cb)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @thaJeztah
    thaJeztah committed Mar 25, 2026
    Configuration menu
    Copy the full SHA
    9b51892 View commit details
    Browse the repository at this point in the history

  2. cli/command: add missing "go:build" comments 

    - commit e8dc2fc modernized loops to
  range over int, which requires go1.22 or later.
- commit 85ebca5 modernized code to
  use stdlib min/max, which requires go1.21 or later.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 9a47118)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @thaJeztah
    thaJeztah committed Mar 25, 2026
    Configuration menu
    Copy the full SHA
    6d71967 View commit details
    Browse the repository at this point in the history

  3. Merge pull request #6883 from thaJeztah/29.x_backport_update_go1.25.8 

    [29.x backport] update to go1.25.8
    @vvoland
    vvoland authored Mar 25, 2026
    Configuration menu
    Copy the full SHA
    bc97f5a View commit details
    Browse the repository at this point in the history

  4. build(deps): bump docker/bake-action from 6 to 7 

    Bumps [docker/bake-action](https://github.com/docker/bake-action) from 6 to 7.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](docker/bake-action@v6...v7)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 6453c4c)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @dependabot @thaJeztah
    dependabot[bot] authored and thaJeztah committed Mar 25, 2026
    Configuration menu
    Copy the full SHA
    af45a23 View commit details
    Browse the repository at this point in the history

  5. build(deps): bump docker/metadata-action from 5 to 6 

    Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5 to 6.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5...v6)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 39d676c)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @dependabot @thaJeztah
    dependabot[bot] authored and thaJeztah committed Mar 25, 2026
    Configuration menu
    Copy the full SHA
    9709c8f View commit details
    Browse the repository at this point in the history

  6. Merge pull request #6885 from thaJeztah/29.x_backport_update_actions 

    [29.x backport] update actions
    @vvoland
    vvoland authored Mar 25, 2026
    Configuration menu
    Copy the full SHA
    f47603c View commit details
    Browse the repository at this point in the history

  7. Merge pull request #6884 from thaJeztah/29.x_backport_missing_buildtags 

    [29.x backport] cli/command: add missing "go:build" comments
    @thaJeztah
    thaJeztah authored Mar 25, 2026
    Configuration menu
    Copy the full SHA
    6b3ca8f View commit details
    Browse the repository at this point in the history

  8. ci: pin actions to digests 

    As a follow-up, we should use the full version (major.minor.patch).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 97b9e04)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    @thaJeztah
    thaJeztah committed Mar 25, 2026
    Configuration menu
    Copy the full SHA
    0da6a51 View commit details
    Browse the repository at this point in the history

  9. Merge pull request #6887 from thaJeztah/29.x_backport_pin_actions 

    [29.x backport] ci: pin actions to digests
    @vvoland
    vvoland authored Mar 25, 2026
    Configuration menu
    Copy the full SHA
    c2be9cc View commit details
    Browse the repository at this point in the history
Loading